Ensure origin in WebSocket headers (#12643)

JunielKatarn · web-flow · commit 05bfd0c98184 · 2024-02-02T09:25:56.000-08:00
* update cgmanifest

* Ensure origin in WebSocket headers

* Use case-insensitive comparison

* Change files

* Assign SetRequestHeader mocks where needed
diff --git a/change/react-native-windows-54b5b78f-b3a6-4249-bf9e-563c2fe5211f.json b/change/react-native-windows-54b5b78f-b3a6-4249-bf9e-563c2fe5211f.json
@@ -0,0 +1,7 @@
+{
+  "type": "prerelease",
+  "comment": "Ensure origin in WebSocket headers",
+  "packageName": "react-native-windows",
+  "email": "julio.rocha@microsoft.com",
+  "dependentChangeType": "patch"
+}
diff --git a/vnext/Desktop.UnitTests/WinRTWebSocketResourceUnitTest.cpp b/vnext/Desktop.UnitTests/WinRTWebSocketResourceUnitTest.cpp
@@ -56,6 +56,7 @@ TEST_CLASS (WinRTWebSocketResourceUnitTest) {
     // TODO: Mock Control()
     mws->Mocks.ConnectAsync = [](const Uri &) -> IAsyncAction { return DoNothingAsync(); };
     mws->Mocks.Close = [](uint16_t, const hstring &) {};
+    mws->Mocks.SetRequestHeader = [](const hstring &, const hstring &) {};
 
     // Test APIs
     auto rc = make_shared<WinRTWebSocketResource>(std::move(imws), MockDataWriter{}, CertExceptions{});
@@ -81,6 +82,7 @@ TEST_CLASS (WinRTWebSocketResourceUnitTest) {
     auto mws{imws.as<MockMessageWebSocket>()};
     mws->Mocks.ConnectAsync = [](const Uri &) -> IAsyncAction { return ThrowAsync(); };
     mws->Mocks.Close = [](uint16_t, const hstring &) {};
+    mws->Mocks.SetRequestHeader = [](const hstring &, const hstring &) {};
 
     // Test APIs
     auto rc = make_shared<WinRTWebSocketResource>(std::move(imws), MockDataWriter{}, CertExceptions{});
diff --git a/vnext/Shared/Networking/WinRTWebSocketResource.cpp b/vnext/Shared/Networking/WinRTWebSocketResource.cpp
@@ -7,6 +7,9 @@
 #include <Utils/CppWinrtLessExceptions.h>
 #include <Utils/WinRTConversions.h>
 
+// Boost Libraries
+#include <boost/algorithm/string.hpp>
+
 // MSO
 #include <dispatchQueue/dispatchQueue.h>
 
@@ -352,8 +355,12 @@ void WinRTWebSocketResource::Connect(string &&url, const Protocols &protocols, c
 
   m_readyState = ReadyState::Connecting;
 
+  bool hasOriginHeader = false;
   for (const auto &header : options) {
     m_socket.SetRequestHeader(header.first, winrt::to_hstring(header.second));
+    if (boost::iequals(header.first, L"Origin")) {
+      hasOriginHeader = true;
+    }
   }
 
   winrt::Windows::Foundation::Collections::IVector<winrt::hstring> supportedProtocols =
@@ -362,11 +369,26 @@ void WinRTWebSocketResource::Connect(string &&url, const Protocols &protocols, c
     supportedProtocols.Append(winrt::to_hstring(protocol));
   }
 
-  m_connectRequested = true;
-
   Uri uri{nullptr};
   try {
     uri = Uri{winrt::to_hstring(url)};
+
+    // #12626 - If Origin header is not provided, set to connect endpoint.
+    if (!hasOriginHeader) {
+      auto scheme = uri.SchemeName();
+      auto host = uri.Host();
+      auto port = uri.Port();
+
+      if (scheme == L"ws") {
+        scheme = L"http";
+      } else if (scheme == L"wss") {
+        scheme = L"https";
+      }
+
+      auto origin = winrt::hstring{scheme + L"://" + host + L":" + winrt::to_hstring(port)};
+      m_socket.SetRequestHeader(L"Origin", std::move(origin));
+    }
+
   } catch (hresult_error const &e) {
     if (m_errorHandler) {
       m_errorHandler({Utilities::HResultToString(e), ErrorType::Connection});
@@ -380,6 +402,8 @@ void WinRTWebSocketResource::Connect(string &&url, const Protocols &protocols, c
     return;
   }
 
+  m_connectRequested = true;
+
   PerformConnect(std::move(uri));
 }
 
